ECCouncil 312-85 問題集

質問 1：
During the process of threat intelligence analysis, John, a threat analyst, successfully extracted an indication of adversary's information, such as Modus operandi, tools, communication channels, and forensics evasion strategies used by adversaries.
Identify the type of threat intelligence analysis is performed by John.
A. Operational threat intelligence analysis
B. Tactical threat intelligence analysis
C. Technical threat intelligence analysis
D. Strategic threat intelligence analysis
正解：B
解説: (Topexam メンバーにのみ表示されます)

質問 2：
Jim works as a security analyst in a large multinational company. Recently, a group of hackers penetrated into their organizational network and used a data staging technique to collect sensitive data. They collected all sorts of sensitive data about the employees and customers, business tactics of the organization, financial information, network infrastructure information and so on.
What should Jim do to detect the data staging before the hackers exfiltrate from the network?
A. Jim should identify the web shell running in the network by analyzing server access, error logs, suspicious strings indicating encoding, user agent strings, and so on.
B. Jim should identify the attack at an initial stage by checking the content of the user agent field.
C. Jim should monitor network traffic for malicious file transfers, file integrity monitoring, and event logs.
D. Jim should analyze malicious DNS requests, DNS payload, unspecified domains, and destination of DNS requests.
正解：C
解説: (Topexam メンバーにのみ表示されます)

質問 3：
A threat analyst obtains an intelligence related to a threat, where the data is sent in the form of a connection request from a remote host to the server. From this data, he obtains only the IP address of the source and destination but no contextual information. While processing this data, he obtains contextual information stating that multiple connection requests from different geo-locations are received by the server within a short time span, and as a result, the server is stressed and gradually its performance has reduced. He further performed analysis on the information based on the past and present experience and concludes the attack experienced by the client organization.
Which of the following attacks is performed on the client organization?
A. Distributed Denial-of-Service (DDoS) attack
B. DHCP attacks
C. Bandwidth attack
D. MAC spoofing attack
正解：A
解説: (Topexam メンバーにのみ表示されます)

質問 4：
Henry. a threat intelligence analyst at ABC Inc., is working on a threat intelligence program. He was assigned to work on establishing criteria for prioritization of intelligence needs and requirements.
Which of the following considerations must be employed by Henry to prioritize intelligence requirements?
A. Understand frequency and impact of a threat
B. Understand data reliability
C. Produce actionable data
D. Develop a collection plan
正解：A
解説: (Topexam メンバーにのみ表示されます)

質問 5：
Sarah is a security operations center (SOC) analyst working at JW Williams and Sons organization based in Chicago. As a part of security operations, she contacts information providers (sharing partners) for gathering information such as collections of validated and prioritized threat indicators along with a detailed technical analysis of malware samples, botnets, DDoS attack methods, and various other malicious tools. She further used the collected information at the tactical and operational levels.
Sarah obtained the required information from which of the following types of sharing partner?
A. Providers of comprehensive cyber-threat intelligence
B. Providers of threat actors
C. Providers of threat indicators
D. Providers of threat data feeds
正解：A
解説: (Topexam メンバーにのみ表示されます)